default client: use custom HostnameVerifier if overridden

Sometimes, it's useful to override the hostname verifier for SSL connections.
One example, would be when you're developing against a test server managed by
another company that's using a self-signed certificate with a mis-matched
hostname. This patch enables that usage by overriding the default
HostnameVerifier in a Dagger module.

Adding test coverage required switching the TrustingSSLSocketFactory from
using an anonymous cipher suite to one that authenticates.  A test keystore is
used for this purpose.  It contains two self-signed certificates, one
each with alias (and CN) "localhost" and "bad.example.com".  The
TrustingSSLSocketFactory is no longer a singleton; it now
optionally takes a key alias as an argument.